CVE-2026-52744 gocd CVE debrief

Who should care

Defenders responsible for GoCD deployments, especially those with authenticated users, should assess exposure and prioritize verification and remediation efforts. This includes reviewing access controls, verifying exposure, and considering upgrades to version 26.1.0 or later.

Why it matters

CVE-2026-52744 allows authenticated users to retrieve sensitive data they cannot otherwise view in the UI. Defenders should prioritize verifying exposure in GoCD deployments, especially for authenticated users with limited access, and consider upgrading to version 26.1.0 or later.

• Potential unauthorized access to inter-pipeline dependency hierarchy details.
• Potential unauthorized access to user-defined pipeline, stage, job, and artifact plugin reference names.
• Verification of exposure and access controls is necessary.
• Remediation priority is medium due to the read-only nature of the endpoint.

Technical summary

The internal GoCD UI fetch-artifact auto-suggestion API at /go/api/internal/pipelines/**/upstream does not adequately authorize access to upstream dependency data. An authenticated user can retrieve inter-pipeline dependency hierarchy details and user-defined pipeline, stage, job, and artifact plugin reference names that the user cannot otherwise view in the UI. The endpoint is read-only and does not permit modification of pipeline data. This issue is fixed in version 26.1.0. Defenders should prioritize verifying exposure in GoCD deployments.

Defensive priority

Defenders should prioritize verifying exposure in GoCD deployments, especially for authenticated users with limited access.

Recommended defensive actions

• Verify GoCD deployments for exposure, especially for authenticated users with limited access.
• Upgrade to GoCD version 26.1.0 or later.
• Monitor for unauthorized access attempts to the internal GoCD UI fetch-artifact auto-suggestion API.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in GoCD. The issue is fixed in version 26.1.0. Evidence is limited to CVE and NVD entries. Defenders should verify GoCD deployments for exposure, especially for authenticated users with limited access, and consider upgrading to version 26.1.0 or later. The CVE Program and NVD provide official details.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.